3 ms·

It's a curl command from a domain he controls, what's the difference between that and downloading a binary?

• MaxLeiter 5y ago
  I would also encourage not distributing binaries without checksums available on multiple sources
  • fragmede 5y ago
    The checksum only proves it came from where it says it did without modification. You still have to trust the original author to be honest about what the code really does.
    • MaxLeiter 5y ago
      And thanks to the nature of open-source it's possible to audit and verify that. (I'm not saying that's necessary in this case)
    • _ph_ 5y ago
      Right, but I would know it is code from the original author and not modified by anyone, who might gain access to the download server.
• _ph_ 5y ago
  The problem is, this install is open for exploit for anyone, who manages to access content on that server. A single exploitable security hole in the web server or its setup, and you can easily compromise anyone installing Asahi Linux. As you are even running a shell script, it is sufficient to inject one line into the installation script, which also installs malware while installing Linux.